NSRL Downloads

Query the Hash Set Online: There is a project called NSRLquery developed by Rob Hansen of RedJack Security LLC, which has two subprojects: nsrlsvr, which provides a server that yields NSRL RDS information on request, and nsrllookup, a simple command-line application that queries the server.
Jesse Kornblum of Kyrus has established a beta testing NSRLquery server at nsrl.kyr.us, and NSRL has been supplying release-day data to support this server.

ISO 9660 images of RDS CDs

If you have a fast Internet connection, you may download ISO 9660 image files and burn your own copy of the RDS CDs.

Be aware that the ISO image files are each approximately 300MB in size.

The RDS, from RDS 2.20 onward, does not support the categorization used in previous releases. For example, you cannot use CD "B" for exclusion of known operating system applications, as was possible previously.

NOTE: the data format has not changed, merely the allocation of space across the media.

The discs contain the following ranges of SHA-1 hash values:
CD "A" 0000000000000000000000000000000000000000
- 3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

CD "B" 4000000000000000000000000000000000000000
- 7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

CD "C" 8000000000000000000000000000000000000000
- BFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

CD "D" C000000000000000000000000000000000000000
- FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

See the description of the RDS contents for details

RDS 2.39 , December 2012

signatures of the four ISO images

description of the RDS contents

The following DVD ISO contains a zip file which holds a single set of RDS files. The format of the DVD ISO is the same as as any CD ISO above. The DVD zipped files hold all the information in the RDS. Special consideration needs to be taken into account when unzipping the archive contained on this ISO. The main hash text file "NSRLFile.txt" is larger than 9 GB when decompressed. You will have to make sure your operating system can handle files of this size before you decompress the zip file. Furthermore some of the compression tools that come pre-packaged with Windows and OS X cannot decompress this archive due to a limitation in their decompression libraries.

Combo DVD - A single 2.2 GB ISO containing all data

Combo DVD SHA1 - A text file containing the SHA1 of the DVD ISO

If you wish to preview the contents, you may download three smaller files without the hash metadata. These files conform to the NSRL data format.

Product listing - 2MB text file

Manufacturer listing - 80KB text file

Operating systems listing - 40KB text file

You can download a 500KB tab-delimited sorted list of all manufacturers' products and versions that are included in RDS 2.39. If you have a different version, a Perl script is available to allow you to generate this list.

Be aware that the converted ZIP files are each between 1.00 and 2.00 GB in size.
NIST has also converted the RDS format data into data files for some commercial products:

Hashes of the zip files

Encase

Hashkeeper

Vogon

AccessData Known File Filter (KFF) tool for FTK updates

Contact nsrl@nist.gov with questions about other formats.

FTK users -- the KFF tool at AccessData's support page uses the most recent RDS data. If you are enountering extremely low (under 10%) exclusion of known files from Windows 7 cases, this KFF should boost exclusions to 90%.

It is your responsibility to verify the ISO image files with the signatures and file sizes once they are downloaded. After you have used the image to create a CD, it is your responsibility to verify the data files on that CD with the signatures provided on that CD.

Reduced Sets

A "minimal" hashset is available which contains only 29,311,203 file hashes. This set only lists one example of every file in the NSRL. It cannot be used to determine all possible sources of a file. Minimal set (1.8GB)
SHA1(RDS_239m.zip)= bc7935956efefa3805bbda9795d93123dad88120
MD5(RDS_239m.zip)= 088d02a459f936a7da1c74e6cb1f009d

A "unique" hashset is available which contains only 17,045,584 file hashes. This set lists the files that appear only once in the entire NSRL collection. Unique set (1.1GB)
SHA1(RDS_239u.zip)= efc3db79656c6ac6bf2b3a61badd3d0a4839a77c
MD5(RDS_239u.zip)= a5fda3fede943022fca63a4c5e4677b8

Converting RDS format to other formats

There is a Windows GUI tool HashConverter.zip that the NSRL is allowed redistribute.

You can pick up the NSRL Perl conversion code at rds2hk.zip
When you unpack the zip file, there is one file, "rds2hk.pl".
enter
      perl rds2hk.pl -h
and you will get the help output:

Usage : rds2hk.pl [-h] -f format [-d RDS_directory]
      [-l logfile] [-p product_id] [-u]
      -h : help with command line options
      -f format : one of hk , 1.5 , 2.0 (MANDATORY)
      -l logfile : print log info to a file
      -d dir : directory holding NSRLProd.txt, NSRLFile.txt
      NSRLOS.txt and NSRLMfg.txt
      -p integer : use one ProductCode from NSRLProd.txt
      -u : guarantee a unique product line in hk output

Enter the command
      perl rds2hk.pl -f hk -d SOME_DIR

and you'll get two files, "outfile.hke" and "outfile.hsh"
that you can rename and pull into Hashkeeper.

Mappings of File SHA-1s to Path/File names

The project was not initially collecting the full path information for all of the files on all of the media in the NSRL collection, but we have some of that data, and it is available here.

You can download a zipped text file, NSRLLocn.txt, which contains the SHA-1, AppID, MediaID, and full path string for 28,569,382 files as of Jan. 7, 2004.

The SHA-1 of the zip file is 7E0B63CDFDBAC7D4664057F15FC7AC66ABE0E2EB and the MD5 is 59C2AB12EBB966C7F984B63D4C057B20 . The size is 460 MB.